Windows – Restrict Internet access to only a web browser in active directory

This is a pretty straightforward configuration. While you can use your Windows Server machine to perform network address translation for the PCs on your network, I'd recommend purchasing a NAT firewall / router device. One of the consumer-grade Linksys devices, for example, would suit you fine.

To configure your Windows Server machine to act as a NAT router for your PCs:

• Start Routing and Remote Access Service from the Administrative Tools program group

• The "Routing and Remote Access Setup Wizard" will start.

• Choose "Network Addres Translation (NAT)"

• Select the appropriate interface for the public interface. Leave "Enable security on the selected interface by setting up a Basic Firewall" checked.

• Specify the LAN IP address of the server computer as the default gateway for PCs.

Edit:

I'd have to see your config hands-on to tell you much more. I've set up W2K3 as a demand-dial LAN router with success in the past. Make sure you can manually connect before you try configuring the demand-dial interface.

If you're being billed per-call or per-minute you're going to have to do some work figuring out what kinds of IP filters to add to keep the server from making excess calls.

In the past I've tended to use purpose-built devices for this function because they generally worked better (more reliable, more configurable) than Windows Server. Most of those devices aren't on the market anymore, so that's probably a losing strategy anyway.

I now have this working. The AD controller doesn't have Internet access but the client does which is the important thing. Here's the configuration...

VM server #1: Active Directory controller

• Network adapter #1: "Internal Network" with IP address set manually

VM server #2: Active Directory client

• Network adapter #1: "Internal Network" with IP address set manually on same subnet as VM #1
• Network adapter #2: "NAT" with IP address set to automatic

Hope this helps someone. At some point I might come back to try and get the AD controller on the Internet as well.